CVE-2024-13266

MITTEL 5.3CVE-2024-13266 · DRUPAL-CONTRIB-2024-030 · Published 09/01/2025 · updated 17/06/2026

Kurz gesagt

CVE-2024-13266 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in drupal/responsive_menu, responsive and off-canvas menu (responsive and off-canvas menu project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.36%, höher als bei 29.6% aller Schwachstellen.
Abhilfe: auf 4.4.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
drupal/responsive_menu Packagist:https://packages.drupal.org/8	`< 4.4.4`	`4.4.4`
responsive and off-canvas menu responsive_and_off-canvas_menu_project	`< 4.4.4`	`4.4.4`

Description

This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths.

The module doesn't respect custom node access restrictions implemented through hook_ENTITY_TYPE_access hooks meaning the titles of restricted nodes can appear in the menu.

Only sites with modules that implement hook_ENTITY_TYPE_access to restrict access to nodes are effected.

NVD description

Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.

References

drupal.org/sa-contrib-2024-030 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free